Stéphane Tailland
411086b0b6
Design agreed in discussion, nothing built yet. Records the agent's role, its scopes and MCP servers, its A2A surface, and the framework choice with its reason — so the next session starts from the decisions rather than re-deriving them. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
4.0 KiB
Flows — the autonomous agents
Runtime: n8n · Mode: autonomous · Two agents in one repo.
| Agent | Client id | Trigger |
|---|---|---|
| Approvisionnement | classic-models-agent-approvisionnement |
nightly |
| Recouvrement | classic-models-agent-recouvrement |
weekly, Monday |
They share a repo because they are not code: n8n workflow exports, same tool, same owner. Splitting them would buy nothing.
Why low-code for these two
Their work is rules, thresholds and due dates — a sequence of conditions and calls, which a visual editor expresses better than code. The LLM is optional on their critical path, which makes them cheaper and more predictable than the conversational agents.
They remain full A2A agents: they publish an Agent Card, accept tasks, answer.
Approvisionnement
| MCP | catalog, sales |
| Scopes | catalog:read, catalog:write, sales:read |
Nightly: detect coming stock-outs, propose reorders.
Exposes check_availability — called by Ventes before promising a delivery
date, and by Catalogue before discontinuing a reference. Returns a decision and a
date, never the stock table.
Recouvrement
| MCP | customers, payments |
| Scopes | customers:read, payments:read, payments:write |
Weekly: unpaid invoices past 30 days, dunning, escalation.
Exposes check_creditworthiness — called by Ventes before accepting a large
order.
Dunning is prepared automatically and sent only after human validation. Sending a letter to a customer is an outward-facing action; a rule bug would otherwise write to the entire customer base in one run.
The A2A server gap
The available n8n community nodes (n8n-nodes-a2a,
n8n-nodes-agent2agent) make n8n
an A2A client: Discover Agent, Send Task.
But both agents here must be servers — Ventes calls them. That needs an
Agent Card on /.well-known/agent.json and a JSON-RPC endpoint with the task
lifecycle. n8n webhooks can do it by hand, at which point it stops being no-code.
Preferred approach: Kong in front of n8n, exactly as it fronts every other resource. Kong serves the Agent Card statically and routes JSON-RPC to the webhook, and token verification lands where it already lives. No new component.
Alternative: a small FastA2A adapter, written once for both — see
classic-models-agent-catalogue, which uses FastA2A already.
The autonomous mandate
No user session exists when these run, so authority must be pre-established: the
user obtains offline_access when creating the mandate, the refresh token is
stored encrypted, and the exchange happens at trigger time. sub stays the user
who mandated, azp says which agent acted.
The MCP servers see no difference between an autonomous and a conversational
call — same sub, same azp, same audiences. That is deliberate: downstream
policy must not need to know the trigger mode.
Two controls that become mandatory here
They were deferrable with a human in the loop. They are not, once an agent loops on its own.
- Read volume caps per
(azp, sub), enforced on Kong. An agent reads a thousand records in seconds where a human clicks ten; a scope authorises the read but says nothing about volume. - Authorisation on tool-call parameters, not just the tool name.
writeauthorises writing, not "this €40k transfer".
An autonomous agent hitting a rule that requires approval must fail cleanly and escalate, never decide. And any approval screen must be rendered from the structured tool-call parameters — never from a sentence the model produced, or a prompt injection writes what the human validates.
Before writing workflows
Read classic-models-agent-platform/CLAUDE.md for the identity model, the
endpoints and the known blockers.
Deliverables in English. Export workflows as JSON and commit them; do not rely on the n8n instance as the source of truth.